Tech giant Microsoft said that it took over the control of 99 websites that it said were used by Iranian hackers to steal sensitive information from targets in the United States, according to court documents.
The hackers “specifically directed” their attacks on people in Washington, Microsoft said in the filing.
The hacking group typically has targeted the personal email accounts of those people who work in both the public and private sectors, including dissidents and workers in government agencies, said Microsoft.
Microsoft sued the hackers in the U.S. District Court in Washington before asking to gain control of the sites, by saying that the hackers had harmed its brand and the value of its trademarks by impersonating its products to trick victims.
In this case, the hackers faked the look and the language of several Microsoft products, including LinkedIn, OneDrive and Hotmail, said Microsoft in the documents.
It was on March 15th that Judge Amy Berman Jackson granted a temporary restraining order that allows Microsoft take over the websites.
2019-03-15 ECF No. 11_TRO a... by on Scribd
The granted order allowed Microsoft to take control of the sites and their domains from the registrars, and host them on the company's own servers.
This way, Microsoft can redirect malicious traffic safely into a “sinkhole,” which allows it to monitor the traffic that otherwise would have been captured by the hackers.
Previously, Microsoft has used this legal and technical approach, including when fighting botnets that spam its users' email inboxes.
It also used the same approach when facing against Fancy Bear (APT 28, or Strontium), a hacking group widely considered to be affiliated with Russian intelligence. At that time, Microsoft said that the hackers targeted think tanks and political groups in both U.S. and Europe.
According to Microsoft, the sites were related to a hacking group, known as 'Phosphorus'.
The group that is also known as 'APT 35' and 'Charming Kitten', is said to have links to Iran.
The hacking group uses a technique known as spear phishing, which includes sending emails and social media links to victims while imitating people or institutions they may know. Thinking that the email and its links are safe, the recipients may click or enter their user credential when prompted, making them fall as victims.
With the login credentials obtained, the hackers can later use them to sign in to official systems, impersonating them to steal sensitive data.
The group is believed to be linked to former U.S. Air Force counter-intelligence officer Monica Witt, who defected to Tehran in 2013 and is later become wanted by the FBI for alleged espionage.
“While we’ve used daily security analytics tracking to stop individual Phosphorus attacks and notify impacted customers, the action we executed last week enabled us to take control of websites that are core to its operations,” explained Tom Burt, a Microsoft security executive.
